What does a PCI DSS assessment cost?
QSA firms almost never publish fees, so buyers fly blind. Below: planning estimates (September 2026) for every cost line, the formula behind our calculator, and what actually drives the fee. Estimates are not quotes.
PCI assessment cost estimator
Answer three questions. The formula is shown below the result — no black box.
The formula and its assumptions
Base fee bands (planning estimates, Sept 2026): Level 1 ROC $30k–$100k · Mid-size ROC $15k–$60k · Guided SAQ $5k–$25k.
Complexity multiplier: simple ×0.85, standard ×1.0, complex ×1.35.
Readiness uplift: from scratch +40–60% of base fee; some controls +15–30%; solid +0%.
Testing floor: +$12k–$55k for the annual pen test and quarterly ASV scans, which apply to every path.
Excluded: remediation (often 1–2× the assessment fee) and internal staff time.
What drives the fee
- Validation path. A QSA on-site ROC costs multiples of a guided SAQ — level is the single biggest lever.
- Scope size. Locations, systems in the cardholder data environment, service providers, and payment channels. Scope reduction (segmentation, outsourcing) is the cheapest way to cut the fee.
- Readiness. A clean environment sails through fieldwork; a messy one pays for re-testing and a longer engagement.
- Standard version. All new assessments are PCI DSS v4.0.1 (v3.2.1 retired March 31, 2025). First-time v4 assessments can surface new gaps.
- QSA brand. Global practices charge more than boutiques — sometimes for good reason (complex scope), sometimes just for the name.
The full cost picture
| Cost line | Planning estimate | Notes |
|---|---|---|
| Level 1 ROC assessment fee | $30,000–$100,000+ | QSA on-site; complex environments exceed $100K |
| Mid-size ROC assessment fee | $15,000–$60,000 | Level 2–3 merchants, Level 2 service providers |
| Guided SAQ | $5,000–$25,000 | QSA-assisted; DIY filing is free |
| Gap / readiness assessment | $10,000–$30,000 | Often credited toward the ROC fee |
| Penetration test | $10,000–$50,000 | Required annually (external + internal) |
| ASV scans | ~$2,000–$5,000/yr managed | Quarterly external scans by an Approved Scanning Vendor |
| Remediation | Often 1–2× the assessment fee | Segmentation, logging, MFA, encryption gaps |
| First-year all-in, Level 1 | $75,000–$250,000+ | Assessment + readiness + testing + remediation + staff time |
All figures are planning estimates dated September 2026, not quotes. See the 2026 pricing report for every figure with its provenance.
Turn this estimate into real quotes
Tell QSA companies your scope once and get competing scoped fees. Free, no obligation.
How it works: tell us once (4 questions, 2 min) → we match accredited QSA companies to your size and scope → they send scoped quotes directly. Free, no obligation.